Access and programmatic use

Public service information and configuration guidance do not require sign-in. Certification documents require verified access.

FedRAMP and current agency customers are necessary parties. Prospective agencies and other parties are reviewed according to the provider sharing policy; a government-looking email alone does not establish eligibility.

Request access below. A provider administrator verifies your organization and grants continuing access. You do not need repeated manual approval to read the package.

Sign in, then open the package inventory. An organization manager can provision system access within that organization and revoke regular grants.

For automation, supply Authorization: Bearer YOUR_CREDENTIAL. GET /api/documents lists every shared file with its ID, format, version, hash, and description. GET /api/documents/{id} retrieves original bytes, including Word and PDF files.

GET /api/policies provides policy names, file names, summaries, computed word counts, versions, update dates, and related practices. GET /api/snapshots lists historical periods; GET /api/snapshots/{version} retrieves a period manifest with file IDs.

GET /api/access-summary returns your applicable access summaries. GET /api/access-inventory is restricted to provider administrators and verified FedRAMP principals.

API credentials are read-only, can be revoked, and are displayed only when issued. Do not put them in URLs. Revocation removes access immediately.

Administrative notifications use a separate reviewed queue. Legacy simulations do not count as actual delivery. Forms and portal posts require externally retained submission evidence.